seeker-genesis-token

Seeker Genesis Token verification

The Seeker Genesis Token (SGT) is a Token-2022 NFT minted once per Seeker device. Holding one is evidence of owning a Seeker, which makes it useful for gating rewards and for one-claim-per-device logic.

Verification has two halves, and both are required:

1. Prove the user controls the wallet — Sign-in-with-Solana (SIWS)
2. Prove that wallet holds an SGT — inspect the wallet's Token-2022 mints

Doing only the second means anyone can submit a real Seeker owner's public address and pass. Doing only the first proves wallet control but says nothing about a device.

This must run on a server

Never decide entitlement client-side. A client can be patched, so a client-side hasSGT boolean is worth nothing. The client's job is to collect a signature; the server verifies it and owns the result.

Requirements:

• A backend you control that can make Solana mainnet RPC calls
• Storage for nonces and claim records
• A mainnet RPC endpoint. A paid provider helps, since the check reads every Token-2022 account the wallet holds — keep that key server-side only, never in an EXPO_PUBLIC_* variable

Prerequisites

A working wallet connection. If the app has none, use the solana-mobile-wallet skill first; this skill assumes useMobileWallet() is available.

Testing needs a physical Seeker device — an emulator cannot hold an SGT. Plan for a code path you can exercise without one, such as a server-side allowlist in development.

Step 1: issue the payload from the server

The server issues the whole SIWS payload, not just a nonce, and stores it under the nonce with a short TTL. Every field the client supplies is a field an attacker chooses, and each one is fed straight to the signature check, so pin them all at issue time.

// POST /api/siws/nonce
const issuedAt = new Date()
const nonce = crypto.randomBytes(16).toString('hex')

const payload = {
  chainId: 'solana:mainnet',
  domain: 'yourdapp.com',
  expirationTime: new Date(issuedAt.getTime() + 300_000).toISOString(),
  issuedAt: issuedAt.toISOString(),
  nonce,
  statement: 'Sign in to verify Seeker ownership',
  uri: 'https://yourdapp.com',
  version: '1',
}

await store.put(nonce, payload, { ttlSeconds: 300 })
return payload